XP desktop migration project - SDLC ? 1351

  • Our IT Dept plans on migrating our site in Asia to a Windows XP desktop platform from the current mix of Win 98 and 2000 systems. (aprox 60 systems total)
    Will this project need to follow the full SDLC process considering the magnitude of the project (risk cost involved) and the fact that the
    Users at this site use their desktops to access the Global ERP system.
    This seems to be a grey area to me when putting it into a SOX perspective. One would expect such a project to follow a strict implementation plan for operational purposes and risk elements however would this project be evaulated under the SOX umbrella, more specifically would it need to follow the SDLC process rather than the far less thorough ‘Change Management’ process
    Your comments would be much appreciated…

  • If I understood your question correctly, I think you are safe going with the more efficient and less comprehensive change management process since the migration does not directly involve upgrading of an IT application such as Oracle, SAP, PeopleSoft, etc.
    Since the migration is in connection with an upggrade in the operating system, this does not directly impact your ability to process, summarize, and cimpile financial information. This is done through the IT financial application that may be operated on the operating system that is being upgraded.
    There are some IT General Controls that might be worth considering during the migration. An example ITGC Matrix may be found at:
    auditnet.org/docs/SOX 404 IT General Controls Matrix 2004.xls
    The IIA recently published a useful guidance document, ‘Change and Patch Management Controls: Critical for Organizational Success’
    The document addresses change management issues and provides overall guidance to comply with SOX requirements.
    Hope this helps,

  • Thanks very much… This will certainly help.

Log in to reply